Threat IntelligenceAlso called: "ip threat intelligence", "ip blacklist"
IP reputation services track which IPs are associated with attacks, spam, and abuse.
Reputation indicators
- Spam sending history.
- Malware distribution.
- Botnet participation.
- Brute force attacks.
- Scanning and probing.
- Age of IP assignment.
- ASN (network) reputation.
Reputation sources
- Blacklists (DNSBL, RBL).
- Threat intelligence feeds.
- Honeypot networks.
- Spam trap data.
- Crowdsourced reports.
Use cases
- Email filtering (block spam senders).
- Web application firewalls (block attackers).
- Access control (geofencing, threat blocking).
- Fraud detection (payment, account creation).
Limitations
- Shared IPs (cloud/VPN) can have mixed reputation.
- False positives from legitimate scanning.
- IP address rotation by attackers.
- Legitimate users behind proxies/VPNs.